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We consider the scenario in which Ahce transmits private classical messages to Bob 
^ ' via a classical-quantum channel, part of whose output is intercepted by an eavesdrop- 



per Eve. We prove the existence of a universal coding scheme under which Alice's 
messages can be inferred correctly by Bob, and yet Eve learns nothing about them. 
The code is universal in the sense that it does not depend on specific knowledge of 
the channel. Prior knowledge of the probability distribution on the input alphabet 



qh' of the channel, and bounds on the corresponding Holevo quantities of the output 



ensembles at Bob's and Eve's end suffice. 
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I. INTRODUCTION 

A quantum channel can be used for a variety of different purposes and, unlike classical 
channels, it has many different capacities depending on what it is being used for, on the na- 
ture of its inputs and what additional resources are available to the sender and the receiver. 
In addition to its use in conveying classical and quantum information, and generating entan- 
glement, a quantum channel can also be used to convey private classical information which is 
inaccessible to an eavesdropper. This allows unconditionally secure key distribution, which 
is impossible in the classical realm. 

The different capacities of a quantum channel were first evaluated under the assumption 
that the channel was memoryless, that is, correlations in the noise acting on successive inputs 
to the channel were assumed to be absent. Holevc- and Schumacher and Westmoreland^ 
proved that the classical capacity of a memoryless quantum channel under the restriction 
of product-state inputs, is given by the so-called Holevo capacity, the unrestricted classical 
capacity then being obtained by a regularisation of this quantity. An expression for the 
private classical capacity was independently obtained by Cai et ai- and by Devetak^, who 
is also credited with the first rigorous proof of the expression for the quantum capacity (first 
suggested by Lloyd^ and further justified by Shor-). 

An inherent assumption underlying all these results is that the quantum channel is known 
perfectly to Alice and Bob. This assumption is, however, not necessarily valid in real- 
world communication systems, since it might be practically impossible to determine all the 
parameters governing a quantum channel with infinite accuracy. Thus one often has only 
limited knowledge of the quantum channel which is being used. This calls for the design of 
more general communication protocols which could be used for transmission of information 
through a quantum channel in spite of such a channel uncertainty. The corresponding coding 
theorems are then universal in the sense that they do not rely on exact knowledge of the 
channel used. 

In the quantum setting, progress in this direction was first made by Datta and Dorlas^ 
who obtained an expression for the classical capacity of a convex combination of memoryless 
quantum channels. This corresponds to the case in which Alice and Bob's only prior knowl- 
edge is that the channel in use is one of a given finite set of memoryless channels, with a 
given prior probability. It is hence the simplest model with channel uncertainty. This result 



was further generalized and extended by Bjelakovic et a/.*'^ who derived the classical and 
quantum capacities of the so-called compound quantum channels, in which the underlying 
set of memoryless channels was allowed to be countably infinite or even uncountable. They 
also evaluated the optimal rates of entanglement transmission and entanglement generation 
through such channels^. In the classical setting, the first study of channel uncertainty dates 
back to the work of Wolfowitzs^iii^, and of Blackwell et a^, who determined the capacity of 
compound classical channels. 

Note that when Alice is interested in sending only classical messages through a quantum 
channel $, she first needs to encode her message into a state of a quantum system which can 
then be transmitted through the channel. Denoting this encoding map by £, one effectively 
obtains a classical- quantum (c — > q) channel W := $ o £ which maps classical messages 
into quantum states in the output Hilbert space of the channel $. Hayashi^ proved a 
universal coding theorem for memoryless c — )■ g channels, as a quantum version of the 
classical universal coding by Csiszar and Korner— . 

In this paper, we consider transmission of private classical information through a c — )■ gg 
channel from Alice to Bob and Eve, and prove the existence of a universal code, for which 
the private capacity of the channel is an achievable rate. The channel is defined by the 
map W : x — > W^^{x) with x G X (a finite classical alphabet) and W^^{x) being a state 
defined on a bipartite quantum system BE. Bob has access to the subsystem B, whereas 
Eve (the eavesdropper) has access to the subsystem E. Such a channel induces two c ^ q 
channels - one from Alice to Bob (which we denote by W^), and one from Alice to Eve 
(which we denote by W^). We prove a universal private coding scheme under which Bob 
can infer Alice's message with arbitrary precision in the asymptotic limit, simultaneously 
ensuring that Eve learns arbitrarily little about the message. The code is universal in the 
sense that it does not depend on knowledge of the structure of the channel W^^. The only 
assumption in the coding theorem is that Alice and Bob have prior knowledge of the input 
distribution p on the set X, and of bounds on the corresponding Holevo quantities for the 
channels W^ and W^. 

As a first step towards proving a universal private coding theorem, we derive an alternative 
proof of a universal coding theorem for a memoryless c — )■ g channel (see Theorem[T]of Section 
TTT|) . Our coding theorem for the c — ;■ g channel W^ , only requires prior knowledge of the 
probability distribution on the input of the channel. It establishes the existence of a universal 



code using which Ahce and Bob can achieve rehable information transmission through the 
c ^ q channel at any rate less than the corresponding Holevo quantity. Our proof employs 
a "type decomposition" and the random coding technique, but unlike Hayashi's proof—, it 
does not employ irreducible representations and Schur-Weyl duality. However, the decoding 
POVM in our universal code is analogous to his, which results in some of the steps of our 
proof being similar. Moreover, like his result, our theorem can be essentially viewed as a 
universal version of a cornerstone of information theory, namely, the packing lemmap^ii^. 

The universal packing lemma ensures that Bob correctly infers Alice's messages in the 
asymptotic limit. In addition, we require that these messages cannot be inferred by the 
eavesdropper. Eve. This obliteration of information transmitted over the channel W^ , in- 
duced between Alice and Eve, is established by employing the so-called covering lemmap^ii^, 
which we prove explicitly below. We also establish that the covering lemma is universal 
because it does not require Alice to have any specific knowledge of the channel W^ . It 
only depends on the Holevo quantity corresponding to the input distribution of the channel. 
The universal covering lemma, when combined with the universal packing, yields our main 
result, namely, the universal private coding theorem. 

Universal coding theorems have been established for other information-processing tasks, 
for example, data compressioni^i"— and entanglement concentration^^i^^. Jozsa et al^^ intro- 
duced a universal data compression scheme which did not require any knowledge about the 
information source, other than an upper bound on its von Neumann entropy. The compres- 
sion scheme was proved to achieve a rate equal to this upper bound. Hence, our first result. 
Theorem [T]of Section llllt can be viewed as the c — )■ g channel counterpart of this result. 
Similarly, our second (and main) result. Theorem [3] of Section |Vl is in a way the c — ?■ gg 
channel counterpart of this same result, under the additional requirement of privacy. 

Note that the work by Jozsa et al^^ was followed by fully universal quantum data compres- 
sion schemes, presented first by Hayashi and Matsumotc^^ and then by Jozsa and Presnell^S, 
in which the von Neumann entropy of the quantum information source was not known apriori 
but was instead estimated. 

In Section ini we introduce the relevant notations and definitions. In Section [ITTl we prove 
a universal coding theorem for a c — )■ g channel. The Universal covering lemma is proved 
in Section |IVl In Section |Vl the results of the previous sections are combined to prove our 
main result, namely a universal private coding theorem. We conclude in Section IVll 



II. NOTATIONS AND DEFINITIONS 

Let S(D-C) denote the algebra of linear operators acting on a finite-dimensional Hilbert 
space "K and let ©(JC) denote the set of positive operators of unit trace (states) acting on 
[K. We denote the identity operator in 23 (CK) by I. For a state p G 2!)(!K), the von Neumann 
entropy is defined as S{p) := — Tr p log p. Further, for a state p and a positive operator a such 
that suppp C suppa, the quantum relative entropy is defined as S{p\\a) = Tr p log p — p log a, 
whereas the relative Renyi entropy of order a G (0, 1) is defined as 

5a(p|k):=^log[Tr(pV^-")]. 

Two entropic quantities, defined for any ensemble of states £ := {p^, cr^-ja-gx, play a pivotal 
role in this paper. One is the Holevo quantity, which is given in terms of the quantum 
relative entropy as follows: 

X(£) = rain S{axQ\\crx'S)ujQ) 
= S{(JxQ\\(yx®(yQ) 

= SQ2p:,a^) - ^P3,-5((T^), (1) 

X X 

where axQ is a classical-quantum state 

O'XQ ■= ^Px\x){x\ (g)Cr^, 

X 

and ax, o-q denote the corresponding reduced states. The second identity in ([1]) follows 
from the fact^: 

minS'(crxQ||o-x ® wq) = S{axQ\\crx ®o-q)- (2) 

The other relevant entropic quantity is the a-x quantity, which is defined for any a G (0, 1) 
in terms of the relative Renyi entropy of order a as follows: 

Xa(£) := minS'a(o-xQ||o-x ®u;q) 



a 



a — 1 

(For a proof of the last identity, see e.g.—). 
It is known that (see e.g.—) 



logTr 



^^Pxcrix)" 



(3) 



limSaiplW) = S{p\\(t) 



Moreover, it has been proved (see Lemma B.S^I) that 



hmxa(£) = x(£)- 



(4) 



Throughout this paper we take the logarithm to base 2 and restrict our considerations to 
finite-dimensional Hilbert spaces. 

The trace distance between two operators A and B is given by 

\\A-B\\^ ■=Tt[{A>B}{A-B)] -Tt[{A<B}{A-B)], 

where {A > B} denotes the projector onto the subspace where the operator [A — B) is 
non-negative. We make use of the following lemmas: 

Lemma 1.— Given a state p and a self- adjoint operator u, for any real 7 we have 

Tt[{p>2-"'uj}uj] <2^. 

Lemma 2 (Gentle measurement lemma^^i^S). For a state p G 1){'K) and operator < A < I, 
z/Tr(pA) >l-6, then 

p - VapVa < 2V6. 

1 
The same holds if p is a subnormalized density operator. 

Lemma 3 (Operator Chernoff bound^). Let cri, ■ ■ ■ ctn be independent and identically dis- 
tributed random variables with values in S(J{), which are bounded between and the identity 
operator I. Assume that the expectation value Eo"m = VL>tl for some < t < 1. Then for 
every < e < 1/2 



Pr i — ^ Urn ^\l±e\n\<2 dim J{2(-^^"'*) 

L m=l j 



(5) 



where k := l/(2(ln2)^), and [1±6]6 = [{1—6)6; {l + e)6] is an interval in the operator order: 
[A; B] = {a e S(:K) : A<a<B}. 

Lemma 4.— For any operator A > and t G (0, 1), we have 



max TrfAor*) = [TrfA^^) 



1-f 



We state here a number of standard facts about types and typical sequences^^i^, which 
we use in this paper. Let X denote a finite classical alphabet of size |X| = k, and let the 
letters of the alphabet X be ordered (e.g. lexicographically): 

X := {xi, X2, . . . , Xfc; xi < X2 < . . . < x^}. 

Let us denote by A^(xj|a:;'^) the number of occurrences of the symbol Xj G X in the sequence 
x"' := (a;i,--- ,a;„) G X". We define the type t(x") of a sequence x" G X" as follows: 
t(x") := q, where q = (gi, q2, . . . , qk), denotes a probability vector of length k with elements 

qi= ^ ' ' 



n 



Let "Py^ denote the set of types in X". The size of CP^ is bounded as follows^: 

l^xl < (^+1)^ = 2"^"^''\ (6) 

where, for any fixed integer k, we define 

Cn(A:):=-log(n + l). (7) 

ft 

Note that Cn{k) — )• as n — ;■ oo. Define the set of sequences of type q in X" by 

r^{q) = {a;" G X" : t(x") = q). 
For any type g G CPj, we have^: 

Throughout this article, we denote the probability distribution on the set X by p, i.e., 
P = {PiyP2, ■ ■ ■ ,Pk), where pi := p^. for Xj G X. The Shannon entropy of p is defined as 
Hip) = -SLiPilogPi- For any 6 > 0, define TJJ^ := {q E 7^ : \qi - Pi\ < Pi5, Vxj G X}. 
Define the set of (5-typical sequences of length n as 

7;,s = U ^(^) 

<Pi5,Wx,eX\. (9) 



I'^^ls 






la;" G X" : 


A^(xi|x") 
n 


-Pi 



For any e,S > 0, some positive constant c := H{p) depending only on p, and sufficiently 
large n, we have^: 

Q„:=Pr{X"Ga^,J>l-£ (10) 

^-n[Hip)+c5] < pu^ < 2-"[^(P)-<=^], Vx" G a]^_5 (11) 

l^^^^l <2"[^(P)+^^], (12) 

where p^n denotes the probability of the sequence x^ and is given by the product distribution 
Px" •= riiLi^i^i- ^^ ^1^° ^^^ ^^^ following bound^: For any type q G ^^,5, 

|0^(g)| >2"[^(5)-^('^)], (13) 

where ri{6) — )■ as 5 — )■ 0. 

Consider a Hilbert space "K, where dimCK = d. Let "^ = {1,2- ■■ ,d}. It follows that 
:K®" = Spanjly") = |t/i) ® ■ • ■ ® |y„) : Vy" G V"}. Let X, = Span{||/") : y" G T^(g)}, where 
Ty (g) is the collection of sequences of type q in "y". Then 

where 7^ is the collection of all types in T- Let Xq = Span{?7®"|y") : Vf/ G U(rf),y" G 
Ty (g)}, where U((i) is the group oi d x d unitary matrices. Note that %g is not associated 
with a preferred basis, unlike Xg. Let Ig G 23 (!K®") be the projector onto "Xq-. 

h= Y. l2/")(2/1' (14) 

and let Iq G !B(CK®"') be the projector onto %q. Since "Xq C X^, we also have Iq < Iq. Define 
the maximally mixed state on %q to be: 

h - p^. (15) 

where \%q\ is the dimension of the space %q. The following inequality holds: 

\Xq\<{n + lY'\Xq\. (16) 

For sake of completeness, we provide a proof of the above inequality in Appendix |Al Further 
define 



Note that r„ does not depend on the choice of the initial basis {| !/")}• Consider a state a 
whose spectral decomposition is given by 

d 

o = Y.\y\y)kv\- (18) 

Then S{a^ = H{X), where A := (Ai, ■ ■ ■ , A^). 
Lemma 5. For any state a G S(!K), 

(n + l)('^'+'^V„>a®". (19) 

Proof. Assume that the spectral decomposition of a is given by ( ITSl) . Then^ 

^®n _ J2 2— [^(5l|A)+//(g)]j^^ (20) 

where D{q\\\) := J2i=i1i^'^Sy denotes the relative entropy. Since 

<(n + if - 



|3Cg| 



Nd2 



= {n + irr^_. (21) 

In the above, the first inequality follows from the following fact (similar to ([H])): |Xg| = 
|'J'-y(Q')| < 2^^^^' for all q G Ty. The second inequality follows from the non-negativity of 
-D(9||A)) Iq ^ -^g; ^iid flT6|) . The final equality follows from the definition f lTSj) of r^. Then 

Kin + lfY.-"! 

q€T?j 
= {n + lf\T^\T^ 

<(n + l)("'+'='V„, 

where the first inequality follows from (12T!) . the next identity follows from (TT7|) . and the 
second inequality follows from the fact (similar to 06])): iCPu] < (ri + 1)°'. D 



Let x" = (xi, . . . , xi, X2, . . . , X2, . . . , Xfc, . . . , Xfc) be the ordered sequence in Tj(g), where 
the number of Xj in x" is A^(xj|x") = rrii = nqi. Define 

^x^ ■= T-mi ® •■•^r^^, (22) 

where each r^^ is defined similarly to (IT7|) . 

For any x" G 'J'x(q'); there exists a permutation s G S'„, such that x" = sx". Let Us be 
the unitary representation of s in JC*^". We can then define the following state that plays 
an important role in the following sections: 

u^n = UsU^^Ul. (23) 

We define the (5-typical projector 11"^ of o"®" to be 

Ks= E l^")(^"l' 

where a is defined in (IT5]1 and T"^ is similarly defined as T^^ in ([9]). 

For any e,6 > 0, some positive constant c := -ff(p) depending only on p, and sufficiently 
large n, we have^: 

Tra®"n:j^5>l-e (24) 

Trn:j,5<2"[^(")+"^1 (26) 

III. UNIVERSAL PACKING 

Consider a classical-quantum channel W^ : x — )■ W^^(x) which maps the input alphabets 
X (with probability distribution p on X) to the set of states in 'D{'Kb), (where dimCK^ = ds)- 
Then using this channel n times gives a memoryless channel W^" = (W^)®"' that maps 
x" G X" to a tensor product state in 2)([K|"): 

W^^ix") := Vr^(xi) ® • ■ ■ ® W^ixn). (27) 

Suppose Alice wants to send classical messages in the set M„ := {1,2,..., M„} to Bob 
through the channel W^" . In order to do this she needs to encode her messages appropriately 
before sending them through the channel and Bob needs a decoder to decode the messages 

10 



that he receives. The encoding performed by Ahce is a map (pn from the set of messages 
M„ to a set An C X". The decoding performed by Bob is a POVM T" := {Ti]^ti, where 
each POVM element Tj is an operator acting on IK^". 

A "c-q" code Qn{W^) is given by the triple e„(iy^) := {M„, (^„, T"}, where M„ denotes 
the size of the code (i.e., the number of codewords). The average error probability of the 
code Gn(W^) is given by: 

p4UW^)) := vrETrW^''"(^n«)(I-T.). (28) 



Mn . ^ 

1=1 



Let Q{W^) := {C„(H^^)}5^]^ denote a sequence of such c-q codes. For such a sequence of 



codes, a real number /2, 

R:= lim -logM„ (29) 

n— >-oo n 

is called an achievable rate if 

Pe [QniW^)) -^0 as n^oo. 

We will refer to a sequence of codes simply as a code when there is no possibility of ambiguity. 
It has been shown thatjii^ for every classical-quantum channel W^ , and any probability 
distribution p on X, there exists a sequence of c-q codes Q{W^) with achievable rate 

k 
i=l 

where 

k 

W"" = Y,P^W''{x,). (30) 

Note that x{p^W^) is just the Holevo quantity of the output ensemble {px^W^{x)}xe_x 
of the classical-quantum channel. However, the decoding POVM T" of the code C„(W^^) 
constructed requires knowledge of the channel W^—^. 

Hayashii^ proved that it is possible to construct a decoding POVM that is independent of 
a given channel W^. He then constructed a sequence of universal c-q codes with achievable 
rate approaching xip, W^) by combining Schur-duality and a classical universal code pro- 
posed by Csiszar and Korner. We use a decoding POVM similar to Hayashi's and construct 
a different sequence of universal c-q codes. Unlike Hayashi's methods of code construction, 
we employ "type decomposition" and the regular random coding technique, though certain 
parts of the proof are similar to those used by Hayashi^. 

11 



Theorem 1. Given a probability distribution p on the input alphabet X, of any classical- 
quantum channel W^ , there exists a sequence, G{W^), of codes which can achieve any rate 
R < xiP^W^), and are universal, in the sense that their decoding POVMs only depend on 
x{p, W^) and not on specific knowledge of the structure of the channel W^ . 

Proof. We will employ the random coding technique to show the existence of such a universal 
code e. 

Let Mn = |Mn|. Let An '■= {Xi\j^J{, where each Xi is a random variable chosen indepen- 
dently, according to 

I P^„/Q„, if, x" e 7^5 

p- := Pr{X, = xn = r - (31) 

I otherwise, 

where Qn is defined in (TTOl) . It is easy to verify that 

\\p-p'h = Y,\pl.~p':A<'^e. (32) 

re" 

The codeword V5„(2) for the z-th message is given by the realization of the random variable 
Xj, taking values x'^ G 0^,5. 

To construct a suitable POVM, we define the projector similar to Hayashi's 

Ax, :={c^x, -2"^"r„>0}, (33) 

where 7,^ is a real number to be determined below. 
Define the POVM element Tj: 

/M„ \-l/2 /M^ \-l/2 

with Kxi being given by (!33|) . Apparently, each Ax^ (and therefore each POVM element Tj) 
does not depend on full knowledge of the channel W^ . We then define the random universal 
codeer,:={X„T,}fll. 

Using the following operator inequality—: 



I - v^STT ^S^/W^T ^ <2il-S)+ 4T, 



where < S* < I and T > 0, the average error probability pe(Crc) i^ (EH]) can be bounded 
as follows: 

P^(^-)<vrETr(I-^^^)^''"™ + XrE E TrAx,W^^"(^.)- (35) 

1=1 1=1 j=l,j^i 

12 



Taking the expectation of (135|) . with respect to the distribution ( 13T]) . we get 

Ebe(erc)] < ]^^E^^ [Tr(I-AxJl^^"(X,)] +— 5^5^E,, [Tr Ax,P^^"(X,)] . (36) 

We evaluate the sum in the first term of the above inequahty in Sec. IIII Al and the inner sum 
in the second term in Sec. IIIIBI These results (in particular, ( H71) and ( l52l) below) yield the 
following upper bound on E [j9e(Crc)]- For any < t < 1 we have that 

E [peie'rc)] < 2-"*[^^-*-^"-^"('=('^s+''s))] + 4(1 _ e)-iM„2-"(^"-^"('^s+'ifl)) + 2e (37) 

where xi~t = Xi-t{{Px,W^{x)}) is the the (1 — t)-x quantity of the ensemble £ := 
{Px,W^{x)}, given by (j3]), and Cn(') is defined through (I7|). Denote 

Bn := 2""*[^i''"^""'^"(''('^s+rfB))] + 4(1 _ ^)-ijvf„2""(^"~^"("'s+rfB)) + 2e. (38) 

Our aim is to show that by choosing 7„ appropriately, we can ensure that e„ — ^ as 
n — 7- oo for any R < x{p, W^). This implies in particular, that if all that is known about 
the classical-quantum channel is the probability distribution p on X and a lower bound 
(say xo) to the value of the corresponding Holevo quantity, xiP:^^): then there exists a 
universal code G{W^), which can achieve any rate R < xo- 

Let 

j^ ^ 2"['R-C"(('=+i)('^B+'^s))], (39) 

Note that this choice respects the definition (129!) of a rate R, since (n{{k + 1)('^b + ds)) -^ 
as ra — 7- oo. Further, for any t G (0, 1), let us choose 

^n = R + r(t) - UHdl + ds)), (40) 

where we define^ 

r{t):=^^{Xi-t-R). (41) 

This choice of 7„ reduces the second term on the RHS of (1571) to 4(1 — s)~^ x 2~"'"(*), and 
the first term on the RHS of (1571) to 

2-nt[xi-t-i?-r(t)+Cn(fc(4+c's))"Cn(fc{4+'^s))] 

^ 2-nt[xi-t-R-{xi-t-R-"-^)] 

= 2-"'W, (42) 

13 



where we have used the fact that r(t), defined by (HTj) . is equivalently expressed as r(t) = 
Xi-t — -R — r{t)/t. Hence we obtain the following: 

E [pe(e"c)] < (1 + 4(1 - e)-') X 2^""(*) + 2e. (43) 

Since this holds for any t G (0, 1), we have in particular that 

E IpeiGrc)] < (1 + 4(1 - e)-^) X 2-"'^'^*6(o,i) r-(t) ^ 2e. (44) 

To prove that E [pe(C"p)] vanishes asymptotically for a suitable range of values of R, it suffices 
to prove that niaxtg(o,i) r(t) > for that range of values of R. From (^ we infer that 

lim xi~t = X, (45) 

where x = x(P? W^). Moreover, the convergence is from below, since t i— )■ Xi-t is monoton- 
ically decreasing. This ensures that for any R < x, there exists a t/j > such that 

xi-t - i? > 0, yt<tR. 

This in turn implies that for any given R < x, 

max r(t) > 0. (46) 

te(o,i) 

D 

Thus there must exist a sequence of codes C„ of rate R < x such that Pe(Cn) — )■ as 
n — 7- oo. It follows that for any e > 0, and sufficiently large n, 



1 X -^ 



where M„ is given by (15^ and Pe(^) := Tr H^^"(y9„(i))(I — T,) denotes the probability of 
error corresponding to the z*^ message. 



A. Evaluation of the first term in (136 

In the section, we closely follow^. 
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Lemma 6. 

E, [Tr(I - AxjVr^"(X,)l < 2-"*[>^i-*-T"-^"('=(4+'ifl))] + 2e (47) 

where Xi-t = Xi-t(y{Px,W^{x)}) is the {l—t)-x quantity of the ensemble £ := {px,W^{x)}, 
defined through ^, and Cn{k{d'^ + ds)) is defined through ^. 

Proof. Consider the projector A^;" defined in (15^ . where 7„ G R. Since [wajnjT^] = 0, and 
this in turn can be shown to imply that for any t G (0, 1)^: 

(I-A..)<a;-*2-*^"r*. (48) 

For sake of completeness, the commutativity of the operators Ux^ and r„ is proved in Ap- 
pendix [B Since W^^x"^) = (iy^(xi))®'^i ® ■ ■■ ® (iy^(xfc))®™S by direct application of 
Lemma O we obtain 

iys"(a;") = ?7,iy^"(x^)f/] 

< (n + l)H<il+ds)^^ (r^, ® . . . ® r„J t/j 
= {n + l)^('^^+'^^)f/,u;,.nf/] 

= {n + iy 

This yields, for any t G (0, 1): 



\Hd%+dB) 



(49) 



cj^n < (n + 1 



,tfe(4+ds) (u/B"(^^^\-* 



and 



Finally, 



(iy^"(x")) 



i-t 



(50) 



(51) 



E,; 



Tr(I-AxjH^^ (X 



= J] p:i[Tr(I-A..)W^^"(x")] 

< ^ p^„ [Tr(I-A,n)l^^"(x")] +2e 

< 2"*^" Tr ( J2 P^^.-iW^^"(^") ) r* + 2e 

Tr($:p:.(W^^"(x"))^r* 



^ 2ntC,n(k(d?g+dB))2'^ilri 



< 2"*f"('=('^^+'^^»2"*^"max Tr(5^p, (H^^(x))'"*)''V 



+ 2e 

f2£. 



xGX 
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The first equality follows from evaluating the expectation. The first inequality follows from 
fl32|) . The second inequality follows from ( HHj) . The third inequality follows from f l5T]) . 
Applying Lemma H] to the above equation, we get 

i-t 



2nt[Cn(fc(rf|+(ii3))+7n] J fjj. 



2nt[Cn(fc(rfl3+di3))+7n] J ^j. 



(Sjn- 



B^^^^l-* 






2e 



Bf^W^-t 



Y^P.iW^ix)) 



xGjC 



1 >^ n(l-t) 
i-t 



+ 2e 



-nt[xi-t-7n-Cn(A:(d|+ds))] 



+ 2£ 



where xi-t = Xi^ti{Px,W^{x)}). 



n 



B. Evaluation of the second term in (I36p 



We have, for given i,j G {1,2,..., Mn} and i ^ j, 



E,j [TtAxW''"{X,)] = Ej [^TAx,E^ [^'"{X,)]] 



E, 






7-6 



< (1 - E)-\n + lY'^B+'is)^^ Tr [Ax,t:„] 

_ n _ ^^-l2^"[')'"~Cn((i|+dB)] 



(52) 



In the above, the first inequality follows from that fact Qn > 1 — £^ and 



tB 



(X>n 



^^"fx") 



x"eX" 



x-"eT 



p,6 



(53) 



The second inequality follows from Lemma [51 The third inequality follows from Lemma [H 
Cnid's + ^b) in the last equality is defined in ([7]). 
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IV. UNIVERSAL COVERING 

Consider the probability distribution p = (pi, ■ ■ ■ ,Pk) on X and a classical-quantum 
channel W^ : x G X — )■ W^{x) G I^CKe), with (Ie = dim^K^;. Then using this channel 
n times gives a memoryless channel (W^)^^ := W^"^ that maps a sequence x" G X" with 
probability p^n := Pxi ■ ■ -Pxn to a product state in 2)(CKf"'): 

W^^ix"") = W'^ixi) ® ■ ■ ■ ® Vr^(x„). 
Let W"" = EtiPiW^i>^i)- Then 



Consider a subset S C X", and define the "obfuscation error" 



A(S) 






E-f^n,^E- 



(54) 



We are interested in finding the smallest "covering" subset S C X" for which A(S) — )■ 
as n — )■ oo. We discover that for any given probability distribution p, the covering set is 
universal in the sense that its size |S| depends only on the value of xiPi"^^)-, ^i-nd not on 
any specific knowledge of the channel W^ itself. Here we provide an explicit proof of the 
fact that A(S) can be made arbitrarily small for any randomly picked subset S C X" as 
long as n is sufficiently large and -log|S| > x(p, P^-^)^^, a result which follows from the 
so-called "covering lemma"— i^^"^. More precisely, given any upper bound (say xi) o^i the 
Holevo quantity xip^ W^^)? there is a subset S of the (5-typical set, T^^ (defined through ([9])) 
for any 5 > Q, for which A(S) — )• as n — )■ oo provided |§| > xi- 

Theorem 2. For any £,5 > 0, let Ln = 2'^'-^'^'^'^'^^', where Xi is a given upper bound on the 
Holevo quantity x{P-i W^). Then the set An = {Xi}-^^, where each Xi is a random variable 
chosen independently according to 

[pl^/Qn, «/a;"GT"5, 
p':.. := Pr{X, = x"} = r " ' '-'' (55) 

I 0, otherwise 

(Qn is given in [TU\) ). satisfies 



FTlA{An)>e + AVk^ + 8\/3e + 2y/k^\<en, (56) 



for a positive constant En (given in (73^) such that En —^ as n -^ oo. 
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Proof. Recall that for any sequence x" G X", there exists a permutation s & Sn such that 
x^ = sXq , where x" denotes the ordered sequence corresponding to x^. Let Ug be the unitary 
representation of s in CKf ", and let us define 

where niL^ ^{x]!;) is the ^-conditional typical projector for the state W^"{x]!;): 



niVB,5(a;") - n^i£;(xj),5 ® ■ ■ • ® n^B(x^)^5, 



and n^'^;. s^ is the (5-typical projector for the state W^'^'ixi) such that 



Let 



Then 



a{xn := n;v-^(^'^)w^''"(^")n;V-.5(^")- 



Tiaix^) = Trn;V^5(a;")iy^"(x") 

= Trn;V-,.«)w^''"«) 

> 1 - te. (57) 

Applying the gentle measurement lemma, Lemma [2], to fl571) gives 

||a(x") - iy^"(s")||i < 2^^. (58) 

Define the (5-typical projector H—e for the average state W such that 

TrniL^ M/ > l-£. (59) 



Define 



Then 



^^ ' W ,5 ^ ' W ,5 



Tr(/)('x") =Tt(t(x'')U'^e 



W ,5 



> TtUILe ^VT^ (x") - ||a(x") - VT^ (x")||i 



W ,5 



>l-e- 2Vke, (60) 
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where the first inequahty follows from the fact that for any operator w, ||u;|| i = max_]i<n<i Tr Uu, 
and the second inequality follows from fl58l) and fl59|) . Applying the gentle measurement 
lemma to (HIjl gives 



(x")-(t(x")||i <2\/5 + 2Vfe. (61) 

Using the triangle inequality, and the bounds f l58|) and f l6T|) . yields 



||(^(a;") - iy^"(a;")||i < 2v^ + 2^5 + 2v^. (62) 

Let 

0:=E0(X,)= Yl Px"</'(^")- 

Then (l60l) implies that 






Tr > 1 - £ - 2V fe. (63) 

Define 

n := (^ - £2-"[^(^'')+'^^]n!L^ > ol . (64) 

(_ W ,0 J 



Note that Up, U!Le = 0. 
Let 0' := n^n. Then 



Tr > Tr — e 



> 1 - 2e - 2^^, (65) 

where the first inequality follows from the fact that the support of U—e has dimension 
less than 2"^^^^^ )+c5]^ go the eigenvalues smaller than £2~"^^^^ )+^''] contribute at most e to 
Tr0, while the second inequality follows from ( 163|) . The following operator inequality holds: 

0' > £2-"[^(^'')+^^]nj_s ^ (66) 



where the inequality follows from the definition ([6i 

For any x" G T"^, let 6'(x") := 110 (x") 11. Note that these operators lie in the subspace 
of the Hilbert space !Kf" onto which the operator U—e project. Consider the operator 
ensemble {p'^nyipix"-)}^"^^^ , where 

^(x") := 2'^[^'=i^'^(^''('<'))-^'^]^(x'^). (67) 
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Note that 



and 



E^PiXi) = 2"[^-iP'^(^''('^'))-'=^]Ee(Xi), 



(68) 



(69) 



E9{Xi) = n0n = . 

By ^, dni]) and ^, we have 

Eij{Xi) > e2-"^(^''^'')+2c5] jjn_^ ^_ ^jQ^ 

Hence, the operator ensemble {p^,'?/'(x")}x."gt" satisfies the condition of Lemma [3] with 

t = £2-"Ml^'^'')+H. (71) 



Applying Lemma [3l we have 



pm i; E ^(^^) ^ [1 ± ^]<^' I ^ 2 Tr(n;,._p2- 



■-L/7ifc£ Z 



39-"[x(p,W^)+2rf] 



£^„ 



(72) 



where k = l/(2(ln2)2), L„ = 2"[^i+2c5] ^^^^^ 



4 := 2 X 2 



-fc£32"[xi-x(P,VK )l+„[5'(ty^)+c5] 



^0 



(73) 



as ra — 7- oo. 

To prove Theorem [21 the above inequality (!72|) needs to be translated into a statement 
about the operators W^"{x"). To do this, assume that for some set An C T^^ such that for 
any e > and for n large enough. 



-^ 5^ ^(x")G[l±e]0'. 



x"^eAn 



Equivalently, 



We shall show that 



\A 



J- J2 ^(^") - <^' 



X fc^ri 



<e. 



A{An) <e + AVke + Sy 3e + 2^^. 
From fTMl) and fl65|) . we obtain that 



Tr 



(^^.S/'^"') 



> 1 - 3£ - 2^^. 



(74) 



(75) 



(76) 
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Since ^(x") = n0(x"')n, applying the gentle measurement lemma to (176!) gives 
A A ^ 



{•^n\ 



[X- - 



X ti./i-7i. 



\A 



h E »(-" 



X ^J\.n 



< 2\ 3e + 2Vk^. 



Likewise, applying the gentle measurement lemma to ( 1651) gives 






1 < 2J2e + 2Vk^. 



We also have 






< 



\A 






(s")-iy^ (x 



-B"/™n\ 



x"eAn 



< 2Vk^ + 2^e + 2Vke, 
where the second inequality follows from ( 162|) . We can analogously obtain 



;:£" 



110 -ly \\i<2Vke + 2ye + 2Vke. 



(77) 



(78) 



(79) 



(80) 



By applying the triangle inequality and combining (179]) . (177|) . (171|) . (I75|) and (15D]) we obtain 
the desired bound ( !75|) for A[An)- The statement of the theorem follows immediately from 

m. 

n 



V. UNIVERSAL PRIVATE CODING 

Consider a. c -^ qq channel W^^ : x — )■ W^^{x) that maps the input alphabet X (with 
the probability distribution p on X) to the set of densities in T){'Kb ® 'Ke)- Such a channel 
induces a classical-quantum channel W^ : x — )■ W^{x), where W^{x) = TteW^^{x), from 
the sender Alice to the receiver Bob. Meanwhile, it also induces a classical-quantum channel 
W^ : X — )• W^{x), where W^{x) = Tr^ W^^{x), from the sender Alice to an eavesdropper 
Eve. 

The communication task is for Alice to send a private classical message in the set 3n '■= 
{1, 2, ■ ■ ■ , J„} reliably to the receiver Bob through n uses of the c ^ qq channel, i.e., through 
p^B"_B" ._ ^y^BE^i^n^ such that Eve cannot obtain any information about the message sent 
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by Alice. In order for them to achieve this goal, Alice and Bob require an encoder and 
decoder, respectively. The encoding performed by Alice is a map V9„ that maps a classical 
message i G 5„ to an arbitrary element x" G Sj C X", where each "covering set" Sj is disjoint 
and has the same size. The decoding performed by Bob is a POVM T" := {Tjjjgg^, where 
each POVM element is an operator acting on JC^". For any arbitrary e > 0, we can formally 
define an {n,e) "private" code GniW^^) := {J„,v?n,T"} for the channel W^^ by 

1. Alice's encoding </?„ : i — )■ x" G Sj C X"; 

2. Bob's decoding POVM T" : D(J{|") -^ 3n, 

such that for n large enough, the following conditions hold: 

• the average error probability of Gn{W^^): 

Pe(e„(H^^^)) := -5^Tr[w^^"(y,„«)(I-T,)j <e. (81) 

• Eve cannot obtain any information on the classical message i by measuring the state 
W^^ix") := Tr^n iy^"-^"(x") that she has access to, i.e., Vi G {1, 2, . . . , J„}: 



A(S,) := 






E-i^n,^E- 



< e, (82) 



7-B' 



where W := (VT )®" and W = J^x^xP^^^i^)- 



Let Q(W^^) := {GniW^^)}'^^^ denote a sequence of such private codes. For such a 
sequence of codes, a real number R, 

R = lim -logJn (83) 

n— i-oo n 

is called an achievable rate if 

Pe {en{W^^)) ^0 as n ^ oo (84) 

Vi, A(Si) ^0 as n -> oo. (85) 

We will refer to a sequence of codes simply as a code when there is no possibility of ambiguity. 
It has been shown that^ for any classical-quantum channel W^^, and any probabil- 
ity distribution p on X, there exists a private code C{W^^) (more precisely, a sequence 
e{W^^) := {e„(W'^^)}^=i of private codes) with achievable rate 

Up, W""^) := x{p, W") - xip, W^). (86) 
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The private code G{W^^) constructed by Devetak- requires knowledge of the channel W^^. 
Our main result in this paper is to show that one can construct a private code even 
without the full knowledge of the c — )■ gg channel W^^. The only prior knowledge required 
for the code construction is that of the probability distribution on the input alphabet X, 
and bounds on the corresponding Holevo quantities xiP^^^) and x{p^^^)- 

Theorem 3. Let W^^ denote a classical- quantum channel with input alphabet X. Given a 
probability distribution p on X and positive numbers Xo ond Xi> such that Xo ^ x{p>^^) 
and Xi ^ x{Pj^^)> there exists a universal private code Q(W^^) which can achieve any 
rate R<Xo-Xi- 

Proof. The idea of the proof is to combine the universal packing lemma and the universal 
covering lemma of the previous two sections. 

Assume that xo > Xi ^^^ define Ic := Xo — Xi- Note that Ic < Ic{p,W^^), where 
Ic{p, W^^) is given by (l86l) . Let {Mn}'^=i and {-L„,}^i denote sequences of positive integers 
such that 

lim -logM„ = xo, (87) 

n—^oo n 

lim - log L„ = xi + 2c(5. (88) 

n— >-oo n 

In the course of the proof it will become evident that M^ is the size of a c-q code and L„ 
the size of a covering set. 

Let Jn = [M„/L„J , and define the sets 3n '■= {1,2,..., J„} and £„ := {1,2,..., L„}. Fix 
(5, e > 0. We first construct a random code C"^. whose codewords are given by realizations of 
the random variables in the set An '■= {-'^i.^jjeignl/Glin]) sach Xj^^ being a random variable 
chosen independently from the (5-typical set, T"^, according to 

p':^ ■■= MX,, = X-} = r^"/"^"' '^ "" ^ ''^'^' (89) 

I 0, otherwise, 

where Q„ is defined in (ITUIl . 

Note that there are at most M„ pairs of classical indices {j,i). Then by using fl57|) and 
the fact that xo < x{Pj^^)j ^^^ by invoking Theorem [H we know that there exists a 
POVM {Tj/} defined by ( 1M|) . which would allow Bob to identify the pair of classical indices 
{j,i) with average error probability E [pe(Cre)] < ^n, where £„ is given by f l37|) and vanishes 
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asymptotically with n. The definition of the POVM elements only depends on the value of 
Xo and not on specific knowledge of the structure of the channel W^ . 
Define the event 

io = 4"^={Pe(e:;)<v^}, 

and let Iq denote the complement of the event Iq. Then using the upper bound on E [pe(Cre)]) 
and the Markov inequality (see e.g.—) for the random variable pe(C^(,), we have that 

Pr{ia = V,{p,{Ql) > V^} 

< v^. (90) 



Let Aj = {Xj^i}i(zc„, and define the following events: 

I, := I A(^f ^) <e + AVke + Sy 3£ + 2Vke\ 



"-J •" 



where A{Aj ) denotes the "obfuscation error" of the set Aj , defined as in ( 15^ . Then by 
invoking Theorem |2l we have for each j = 1, . . . , J„ 

Pr{I,^} < C (91) 

for a positive constant e^ defined by (1731) . which vanishes asymptotically with n. 
Combining ( 190|) and ( 19T|) gives 

Pr{(io n ii n ■ ■ ■ n i^J^} = Pr{i^ u i^ u ■ ■ ■ u i}J 

(92) 

which goes to as n — )■ oo. Hence, there exists at least one realization of the set An (and 
hence of the random code C"^); fo^ which each of the events Ij, for j = 0, 1, . . . , Jn, occurs. 
Equivalently, (EI]) and (ES]) hold. 

Note that ( 192|) implies that for n large enough, the event Iq fl Ii fl ■ ■ ■ fl Ij„ occurs with 
high probability, and this in turn ensures that the realizations of the sets A"" for j E 3n are 
mutually disjoint. Hence, in order to reliably transmit private classical messages to Bob, 
Alice maps each of her private messages onto a randomly picked element in each different 
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disjoint set, there being \3n\ = Jn such sets. She can thus achieve a rate 

R = hm — log Jn < /c — 2c(5, 

Since S is arbitrary, we arrive at the statement R ^>- Ic = Xo ~ Xi from below, and there 
exists at least one particular realization C„ = {x", Ti}i,^g„ of C"^, of rate R such that 

D 

VI. CONCLUSION 

We have shown that there exists a universal private coding scheme for a. c -^ qq channel, 
W^^, which Alice can use to transmit private messages to Bob (who has access to the system 
B), at the same time ensuring that an eavesdropper. Eve (who has access to the system 
E) does not get any information about her messages. The coding scheme only requires 
knowledge of the probability distribution p on the input alphabet, X, of the channel, and 
of the corresponding bounds on the Holevo quantities of the c — ;■ g channels W^ and W^, 
induced between Alice and Bob, and Alice and Eve, respectively. More precisely, a lower 
bound (say Xo) on x{p,W^), and an upper bound (say xi) on xiP^^^) suffices. This is 
because our universal private coding scheme is obtained by combining the universal packing 
lemma (of Section [ITT|) and the universal covering lemma (of Section HVT) . which depend on 
these bounds. 

Prior knowledge of the probability distribution p on the channel's input alphabet seems 
crucial both in Hayashi's coding scheme^, as well as in ours. In contrast, the classical 
results on universal packing and universal covering^^ do not require this knowledge. For the 
universal private coding, we also require knowledge of the values of Xo and Xi individually. 
It would be interesting to know whether there exists other coding schemes which require 
less prior knowledge, for example knowledge of Ic := Xo — Xi alone. 

Our result on universal private coding can be generalized to the case of general quantum 
channels if some further information is available, as explained below. In the most general 
setting of transmitting private information over a quantum channel, 'N, the sender Alice 
prepares a quantum input state p. Notice that there are unlimited number of ensemble 
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decompositions {pi,Pi} of p, satisfying p = 'Yli^xViPi- Each such decomposition induces 
a. c —> qq channel, W^^ , from the isometric extension Ujsj of K, such that the induced 
channels are given by W^ : i — > 3\l"(pj) and W^ : i — )■ 3\l"(pj), where !N denotes the channel 
which is complementary to !X. By using Theorem [31 for each such ensemble {Pi, Pi}i£x, we 
can then design a universal coding scheme which achieves a private transmission rate equal 
to Ic{{pi, Pi}). Moreover, if prior knowledge of an ensemble which would lower bound the 
Holevo quantities of all possible c — t- g channels W^ , and upper bound the Holevo quantities 
for all possible c ^ q channels W^, is available, then we can achieve the universal private 
coding for this general setting by direct application of Theorem [31 The private transmission 
rate achieved would then be given by 

Ip := min Ic{{pi,Pi}). 
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Appendix A: Proof of (I16p 

Let Md be the linear space of all d x d complex matrices. Then %q C Span{yl®"|y") : 
A G Md, |y") G Xg). For any fixed |y") G Xg, let 

X,(y") = Span{A^"|y") : A G M,}. 

It then follows from Ref.~ that 

\Xgiy'^)\<in + lf. 

By dimension counting, we have 

\Xg\< Y. |3C,(i/")|<(n + l)'^'|X,|, 

where |T^(g)| = \Xq\ 
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Appendix B: Commutation relations 

Lemma 7. For any a G 'D('K), and Tn defined by [T7\ ), the commutator [r„,o"®"] = 0. 
Proof. Let ^ = {1, 2, ■ ■ ■ , d} and d = dimCK. Recall that 

where A = (Ai, ■ ■ ■ , A^) is the vector of eigenvalues of a and Iq is the projection operator 
defined by ^. 

We have Iq < Iq from the fact that Xq C %q,\fqE T"^. It follows trivially that [r„, a®"] = 
0. D 

Lemma 8. Given a type p G 7^, and a sequence x" G 7j{p), let x" be the corresponding 
ordered sequence in 7^{p)- Then we have [u)x^,Tn] = 0. 

Proof. By definitions of (fTT]) and (|22|), 

^-o = n ]r^\ J2 • • • Yl ^gfxi^ ® ■ • • ® ^'/fx^'- 

It follows from (IT5|) that the term ry(xi) (X) ■ • ■ (g) t^Cx^.) in the summand of u^^ can be written 
as: _ _ 

/g{xi) ® ■ • ■ ® /g(x,) 

T„(xi) ® ■ • • ® r„(xj^) = r = , 

lli = ll\(x,)jl 

where each q^^^^ = (qi , ■ ■ ■ , q^ ) is a type in CPu''. The following proof holds for every term 
of ojx^- Define /* := /^(xi) ® ■ ■ ■ ® /^(xfc), where 

For any sequence y^ G 'J^'Ho''-'^^'') x ■ ■ ■ x T^'' {q^^'''^) , the number of times any i G V appears 
in the sequence ?/" is given by 

k 

N{i\y-) = Y,^j<if'\ 
i=i 

where g^ is the i^^ element in the probability vector q^^^'. Such a sequence y" must also 
belong to Ty (g) for the type g G ^y , where the i-th element of q is 



9i = = -^ = l^PiOl ■ 

n n ^-^ 
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In short, we can write q = Yl]=iPj<i:'^''' ■ Therefore T^^{(^'^^'') x ■ ■ ■ x 7^'' {(^'^''^) C 1^(g), and 



Furthermore, we can obtain 



/* < /,. 



/* < /,. 



Therefore [Tg(xi) ® ■ • • ® Tg(xfe), r^] = for all q E 7^ and for all g^'*'^ G CP^'. By linearity, we 
have [c(;x.n,r„] =0. D 

Lemma 9. [w^,." , t;„] = 0. 

Proof. For any sequence y^ G T^^{q^^^'^) x ■■■ x T^'" [q^^^^) ^ we know from Lemma [8] that 
y" G 'J'IJ'(g), where q = J2j=iPj9^^^^- Furthermore, s?/" must also belong to Ty(g), where 
s G 5^ is a permutation such that x"' = sx^- Denote 

a" = {sy^ : Vy" G O^H^^'^^^) x ■ ■ ■ x 07'=(g('<^))} C a7(g). 

Let /* = UgPUl, where /* is defined in fIBll) . Obviously I* < Iq. Then following the same 
argument as in Lemma [HI we can conclude that [cUaj'ijTn] = 0. 

D 
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